baodev0andClaude Opus 5.5
e888a6ed5d
- Turnstile (App\Support\Turnstile, middleware turnstile) cho login admin và login/register/forgot/reset của khách; cấu hình ở setting key=turnstile, secret mã hoá SignRSA. - Menu sidebar khách (setting client_menu) và nút tắt topbar (setting client_quick_links) do admin sửa qua administrator/client-menu[/quick-links], khách đọc v1/setting/menu, v1/setting/quick-links. - v1/setting và settings/public chỉ trả whitelist PublicSetting::FIELDS (trước đây lộ bot_token, inet_api_key). - Cài đặt tài khoản khách (preferences), rate limit theo IP cho register/resend-verify. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
1.4 KiB
PHP
43 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\Client;
|
|
|
|
use App\Models\Setting;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Tests\TestCase;
|
|
|
|
class PublicSettingTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_public_setting_endpoints_expose_only_whitelisted_fields(): void
|
|
{
|
|
Setting::updateOrCreate(['key' => 'setting'], ['value' => json_encode([
|
|
'title' => 'Portal',
|
|
'brand_color' => '#EF6824',
|
|
'bot_token' => 'secret-bot-token',
|
|
'inet_api_key' => 'secret-inet-key',
|
|
'telegram_group_id' => '-100123',
|
|
'admin_email' => 'admin@example.com',
|
|
])]);
|
|
|
|
$client = $this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->getJson('/v1/setting')
|
|
->assertOk()
|
|
->assertJsonPath('data.title', 'Portal')
|
|
->assertJsonPath('data.brand_color', '#EF6824');
|
|
|
|
$admin = $this->getJson('/api/v1/settings/public')->assertOk();
|
|
|
|
foreach ([$client, $admin] as $response) {
|
|
$body = $response->getContent();
|
|
$this->assertStringNotContainsString('secret-bot-token', $body);
|
|
$this->assertStringNotContainsString('secret-inet-key', $body);
|
|
$this->assertStringNotContainsString('-100123', $body);
|
|
$this->assertStringNotContainsString('admin@example.com', $body);
|
|
}
|
|
}
|
|
}
|